LkSG documentation: evidence and audit trail in procurement
What has to be documented continuously, how long it has to be kept and which part procurement covers with Ovenca.
Under section 10(1) LkSG, fulfilment of the due diligence duties has to be documented continuously within the company, and the documentation has to be kept for at least seven years. If evidence is only gathered from emails and folders when a request arrives, time is lost and gaps appear. Ovenca logs procurement transactions at the moment they happen.
- Audit trail
- Export as CSV or JSON
- Configurable retention
- Status October 2026
The documentation duty and the reporting duty are two different things
Section 10 LkSG governs both: internal documentation in subsection 1 and the annual report in the subsections that follow. The government bill amending the LkSG would remove the reporting duty, and BAFA has not reviewed company reports since 2025. The documentation duty is not affected. Irrespective of the law, customers, auditors and internal audit also expect traceable records. This page is not legal advice.
What LkSG documentation comprises and what Ovenca records
Four levels. Two of them arise in the procurement system, two are kept outside it.
Procurement transactions
Ovenca logs user actions with timestamp, user ID and action.
- Orders and approvals
- Catalog changes with old and new value
- User and role changes
- Administrative actions and API calls
Supplier records
What suppliers submit in the Vendor Portal is recorded with status and history.
- Self-disclosures and certificates from onboarding
- Submissions, approvals and rejections with timestamp
- Change history with comparison of old and new values
- Comments between procurement and supplier
Risk analysis and measures
Assessments, reasoning, action plans and effectiveness checks are part of the documentation but are not created in Ovenca.
- Kept in the compliance tool or in the template
- Ovenca supplies order and catalog data as an export
- Blocking of catalogs and items is traceable in Ovenca
- Linked through the supplier number from the ERP
Reports and exports
For internal audit, customer requests and management, data from several sources is brought together.
- Log export as CSV or JSON
- Order and usage statistics, exportable for Excel
- Report access controlled by role
- Ovenca does not generate finished LkSG or CSDDD reports
What makes documentation hold up
Documentation holds up because of the way the data is created, not because of a report at the end of the year.
- Captured in the transaction
- Approvals and changes are logged when they happen and do not have to be reconstructed later.
- History instead of overwriting
- In the Vendor Portal the change history per item and catalog is retained, including earlier values.
- Set retention to fit
- By default, audit logs in Ovenca are kept for at least two years; the period can be extended to up to ten years. For the seven years required by the LkSG it has to be set accordingly.
- Roles and access
- Roles and permissions define who may see logs and reports. Custom roles can be defined.
- Data kept in the EU
- Ovenca can be operated on-premise or as a private cloud in EU data centres. Access is controlled through roles and permissions, single sign-on and multi-factor authentication.
- In corporate use at LANXESS
- LANXESS AG has worked with Onveda since 2014 and uses Ovenca worldwide as its eProcurement platform, with approval processes, SAP integration and reporting.
Questions and answers on LkSG documentation
Related pages
Documentation that arises in the procurement process
Together we look at which evidence your internal audit requires, what Ovenca logs and what has to come from other systems.